Business Email Compromise (BEC) attacks – in which threat actors assume the identities of business executives over email and try to trick employees into sending a wire transfer or something similar – are going mobile, security experts have warned.
A report (opens in new tab) from Trustwave found the number of BEC attacks that leverage the Short Message Service (SMS) instead of email has been steadily increasing.
The process is almost identical – the attacker would reach out to the victim, introduce themselves as one of the company’s executives, and share a copy of an aging report. In the same message, they’d ask the victim to initiate a wire transfer, change a payroll account, or have them transfer company funds in some other way.
More potent than email
There are many benefits to using SMS for BEC attacks instead of emails, the researchers say. The obvious one is that there are fewer elements that can make the target suspicious. While every email carries the sender’s address, which can be the first way to check for potential fraud, an SMS message only has the phone number and in many cases, employees don’t have their bosses’ numbers and might not double-check them.
Furthermore, the attackers can decline a potential phone call, saying they’re in a meeting or otherwise unable to answer the call. Finally, SMS communication is a lot faster than email, allowing threat actors to get the job done a lot quicker, with Trustwave also highlighting a Federal Communications Commission (FCC) report stating unsolicited text messages tripled in 2022, compared to 2019.
Initiating wire transfers is also something that might raise suspicions, which is why fraudsters usually ask the victims to purchase a gift card, instead. They would promise the victims that their purchase would be reimbursed. Most of the time, the crooks would ask their targets to purchase gift cards from Target, Google Play, Apple, eBay, or Walmart.
To protect against SMS-based BEC attacks, businesses should educate their workforce on security (opens in new tab) awareness, and have them always verify people’s identities when communicating via text messages, Trustwave said.
Furthermore, they should raise awareness among their employees that private data can be scraped from social media accounts and used in attacks, and finally – they should insist on multi-factor authentication (MFA) wherever possible, to make it harder for threat actors to gain access to valuable systems.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba